OHIO passwords to require secret questions

Thursday, April 17, 2014
Sean O'Malley

In the coming months, an increasing number of OHIO online services will require you to have secret challenge questions set for your OHIO password.

The first services to include this requirement will be the university's Oracle e-Business Suite, My Personal Information and the My OHIO portal. Anyone wishing to access these services after this summer's Oracle upgrade will need to have secret challenge questions associated with their OHIO password.

Improved security and convenience

Self serve password resets - If you forget your OHIO password, you can use your secret challenge questions to reset it yourself. No calls to the Service Desk or faxed ID verifications required.

Single sign-on potential - Secret challenge questions are a prerequisite to allowing a single login to grant entry to multiple OHIO online systems

Improved security - When you set your secret challenge questions, you also will be prompted to choose a password that meets the university's current password complexity requirements.

Don't get phished!

Phishing attacks are likely to increase in the coming weeks, as scammers take advantage of widespread password change recommendations. Do not respond to unsolicited emails asking you to click a link to update your password or activate/verify your account or your personal information.

If OIT needs you to log into a web page, that page will not be clickable inside an email message. Instead, we will include instructions on how to reach that link from the OHIO front door. For example, in a recent message to users who might have been affected by the Heartbleed security bug, we included the following instructions:

To change your password, look for a link on any of these OHIO web pages:

Students page

Employees page

Information Technology home page

None of those bulleted items was clickable - by design. The recipient had to open a web browser, type in "www.ohio.edu" and then navigate to one of the named pages.